Date header missing from the Switch signature in timeout scenario

[sri-miriyala]

Summary:
When we validated the timeout scenario after the JWS signature generation capability in switch, found that the Date header is missing from the protected headers.
Severity:
High
Priority:
Critical
Expected Behavior
The JWS signature should contain the Date header in protected headers.

Steps to Reproduce

Send POST /quotes request from happy path

Send POST /transfers request from happy path by modifying the transferExpiration from the pre-request script. Change that to 1.2 sec instead of 60 sec like below.
pm.environment.set("transferExpiration",new Date(new Date().getTime() + 1200))

Check the logs at payerfsp, payeefsp

Response:
{
"headers": {
"host": "dev1-sim-payerfsp.mojaloop.live",
"connection": "close",
"x-request-id": "a96198f184a6bebc442796f1c7b94afa",
"x-real-ip": "10.1.2.224",
"x-forwarded-for": "10.1.2.224",
"x-forwarded-host": "dev1-sim-payerfsp.mojaloop.live",
"x-forwarded-port": "80",
"x-forwarded-proto": "http",
"x-original-uri": "/sim/payerfsp/inbound/transfers/4f1c5723-c62b-4204-b4b4-93fc06916af7/error",
"x-scheme": "http",
"content-length": 84,
"content-type": "application/vnd.interoperability.transfers+json;version=1.0",
"accept": "application/vnd.interoperability.transfers+json;version=1.0",
"fspiop-destination": "payerfsp",
"date": "Tue, 15 Sep 2020 18:08:30 GMT",
"fspiop-source": "switch",
"fspiop-http-method": "PUT",
"fspiop-uri": "/transfers/4f1c5723-c62b-4204-b4b4-93fc06916af7/error",
"fspiop-signature": "{"signature":"LO4WH3XpelRSM5uE18PLW8tqMDKbzv4WqznTWsxNfMdmmDjWwhPGVdoLuvrhXBA1z34LK3b3N2McOm9tAUL9wFz-Y3qHOo1dBztFqJDqqc1wRAoJ-FQOHiQu2HiUeBEaH3i9tEZWANf_UUJl9PRM-8LU8sH6qjW5nbxEaXwGLsa_-AwNr0KO_OEQRkqyRhFAK1wCmlBST3f_0bey6JOAV1XE9vdI1Ej4NvZ8vfhMGxN4SJhGp-UB3MK7IuK90zXJcZPeHME2OUcle-wr2adcnGxX_1yVz1IneE_ltitcIGAnS648kIB9DTV_AqRBqqx-b_CEFh0VIZwSAapVOuVddA","protectedHeader":"eyJhbGciOiJSUzI1NiIsIkZTUElPUC1VUkkiOiIvdHJhbnNmZXJzLzRmMWM1NzIzLWM2MmItNDIwNC1iNGI0LTkzZmMwNjkxNmFmNy9lcnJvciIsIkZTUElPUC1IVFRQLU1ldGhvZCI6IlBVVCJ9"}",
"traceparent": "00-de64620a0f4d8bd80ed262e2b78d739a-1db745b8b7007ca0-00",
"tracestate": "mojaloop=eyJzcGFuSWQiOiIxZGI3NDViOGI3MDA3Y2EwIn0=",
"user-agent": "axios/0.19.2"
},
"data": {
"errorInformation": {
"errorCode": "3300",
"errorDescription": "Generic expired error"
}
}
}

Screenshot:

Specifications

Component (if known): ml-api-adapter, CL
Version: ml-api-adapter is 11.0.3, CL : 10.6.1
Platform: Mac
Subsystem: Mojaloop
Type of testing: Feature
Bug found/raised by: Sri & Egor

• Severity when opened:
• Priority when opened:

Note:

• timeout handler (cron job) -> positions queue with state set as 'TIMEOUT-RESERVED' -> position handler -> notification handler topic; notification handler sends notification to payer with headers.
• protected header is obtained by decoding using base64 the "fspiop-signature". The signing happens in the ML-API-adapter

Tasks:

• Investigate what needs to be done to fix this.

Pull Requests

• Bugfix/1709 1710 headers invalid case central-services-shared#257
• Bugfix/1710 1709 headers invalid case central-ledger#787
• updated to latest central-ledger version helm#385
• updated the correct file this time postman#182

[amarmodus]

Date header missing in protected headers

Run fulfil-reserved-v1.0 in GP Mojasim collection

{
   "headers":{
      "host":"dev1-sim-payerfsp.mojaloop.live",
      "connection":"close",
      "x-request-id":"cd9602d40606648ede85e2183a050785",
      "x-real-ip":"10.1.2.224",
      "x-forwarded-for":"10.1.2.224",
      "x-forwarded-host":"dev1-sim-payerfsp.mojaloop.live",
      "x-forwarded-port":"80",
      "x-forwarded-proto":"http",
      "x-original-uri":"/sim/payerfsp/inbound/transfers/861e272a-4f81-4979-b03e-eae378cc83d2/error",
      "x-scheme":"http",
      "content-length":84,
      "content-type":"application/vnd.interoperability.transfers+json;version=1.0",
      "accept":"application/vnd.interoperability.transfers+json;version=1.0",
      "date":"Mon, 21 Sep 2020 21:35:15 GMT",
      "fspiop-http-method":"PUT",
      "fspiop-uri":"/transfers/861e272a-4f81-4979-b03e-eae378cc83d2/error",
      "fspiop-source":"switch",
      "fspiop-destination":"payerfsp",
      "fspiop-signature":"{\"signature\":\"kldWLw8cI7G9WVUOqUbAp9WgwZsnL1l2Vw6De9YyPmFD7oNQq-Gy7qOsFQLogONzU-KFBRC_2pWV-ktNpUswwPYhX0x9ObKL3YFKqwEKifMa3oefm3267AeMREFtXMNidsdyzrArz6hyY9xmUqT3hghEbUCKe5smSjl9gXxpWkpuXJXuJT35MXUFVFdKOKZzlzFwS0kvSbhxA2MsHRvx6WhbZUCKmK9bXtamdv0dNt_tJIL1eNdZZU69sIDy35RCngAchQfme31fR60hQQroev3b5RznAqe-o6C_KKXZdxM1HdstHyBljl6O3iuteJFESB4HCoAOjfWw0Zkq10MB8w\",\"protectedHeader\":\"eyJhbGciOiJSUzI1NiIsIkZTUElPUC1VUkkiOiIvdHJhbnNmZXJzLzg2MWUyNzJhLTRmODEtNDk3OS1iMDNlLWVhZTM3OGNjODNkMi9lcnJvciIsIkZTUElPUC1IVFRQLU1ldGhvZCI6IlBVVCIsIkZTUElPUC1Tb3VyY2UiOiJzd2l0Y2giLCJGU1BJT1AtRGVzdGluYXRpb24iOiJwYXllcmZzcCJ9\"}",
      "traceparent":"00-b7ad9dd13efbc1437ecd7916e4d505d1-6802f586a57929c6-00",
      "tracestate":"mojaloop=eyJzcGFuSWQiOiI2ODAyZjU4NmE1NzkyOWM2In0=",
      "user-agent":"axios/0.20.0"
   },
   "data":{
      "errorInformation":{
         "errorCode":"3300",
         "errorDescription":"Generic expired error"
      }
   }
}

[sri-miriyala]

@amarmodus the error you are seeing is different.
Can you pls try giving numbers between 1200 and 2000 in the "pm.environment.set("transferExpiration",new Date(new Date().getTime() + 1200))" from pre-req scripts. So that the error should be coming as expired after entered into the switch.
There is a sim rule on our side to check this but some how it is not working in OSS envs. Need to check if the rule is present or not. But to check that pls try different numbers between 1200 and 2000, until you see 3300 - Generic expired error.
Also we were talking about the date header in the signature protected headers. For that you need to decode the protected headers part of the signature using base64.

[amarmodus]

@sri-miriyala - updated my previous comment & log(this is same as #1710 replication of bug) - the condition is replicated in one of the test from GP test collection. in P2P happy path, transferExpiration with 1200 and 2000 i could only see

"data":{"errorInformation":{"errorCode":"3100","errorDescription":"Generic validation error - invalid fulfilment"}}}

for less than 1200 getting

"errorCode":"3100","errorDescription":"Generic validation error - Expiration date 2020-09-22T09:31:58.859Z is already in the past"}

[amarmodus]

https://www.base64decode.org/ - decoded protected header

eyJhbGciOiJSUzI1NiIsIkZTUElPUC1VUkkiOiIvdHJhbnNmZXJzLzg2MWUyNzJhLTRmODEtNDk3OS1iMDNlLWVhZTM3OGNjODNkMi9lcnJvciIsIkZTUElPUC1IVFRQLU1ldGhvZCI6IlBVVCIsIkZTUElPUC1Tb3VyY2UiOiJzd2l0Y2giLCJGU1BJT1AtRGVzdGluYXRpb24iOiJwYXllcmZzcCJ9

{"alg":"RS256","FSPIOP-URI":"/transfers/861e272a-4f81-4979-b03e-eae378cc83d2/error","FSPIOP-HTTP-Method":"PUT","FSPIOP-Source":"switch","FSPIOP-Destination":"payerfsp"}

[elnyry-sam-k]

Thanks @amarmodus